Welcome to Splunk Answers, a Q&A forum for users to find answers to questions about deploying, managing, and using Splunk products. Contributors of all backgrounds and levels of expertise come here to find solutions to their issues, and to help other users in the Splunk community with their own questions.

This quick tutorial will help you get started with key features to help you find the answers you need. You will receive 10 karma points upon successful completion!

Refine your search:

How do I take the ratio of (sum of 2 categories) / (total categories)?

0

Though this question seems similar to the other discussions, I'm having a hard time relating to them.

A network service has sites across the country in different cities. For example if there are 2 sites ( lets say seattle and woburn) I want to compare the total number of unique users from these two cities with the rest of the cities. So far, I'm only able to get the sum of the number of users from (woburn and seattle). Here's my search:

Currently this is only populating the total # of unique users from woburn and seattle. My goal is to maybe create another bucket that will store the total # of users from all the other sites. Then get the ratio of (users from seatle/woburn) to (rest of the cities). Basically trying to get the traffic ratio. Hope that makes sense and any help is appreciated! Thanks

That's helpful however, I think now its giving me the total of the "others" sites. Before, I was getting total users from just seattle and woburn. I want to find out ((users from seattle + woburn) / users from "others"). Does that make sense? Sorry I should've been more clearer.

You should get two rows, one with Site=Overseas and OverseasUsers ( I should've renamed that column) as unique users from woburn and seattle., and other with Site=Others and corresponding unique users count. Are you not getting that?

Oh got that to work!! Thank you. Going back to the original problem, now that we have two different values (one for others and one for (overseas). Any idea how I can divide overseas by others to get a value?

Hey so the search you provided did give me some sort of ratio, however, I'm not sure if that's correct. It gave me a ratio of 1. I want to display a single value on the dashboard that shows the ratio (i.e: 4.5 or something). I played around and came up with this search, but I'm certain it's wrong.